Automatic Conversion of ABAC Policies for RBAC Systems

The flexibility, portability, and identity-independence of Attribute-Based Access Control (ABAC) make it a desirable choice for various application domains. Despite these advantages, there is no commercial ABAC implementation, and the ABAC model has not been integrated with any database management systems (DBMS) or operating systems. In contrast, the RBAC model is widely used in businesses and standardized by the National Institute of Standards and Technology (NIST). In this paper, we propose a four-step approach to converting ABAC policies for RBAC systems to combine the benefits of both models. We construct trees for user and resource attributes, generate initial roles, prune the roles, and select a minimum number of the roles. Roles in our system are no longer static, and they can be activated and deactivated based on the context at the time of request. The effectiveness of the approach has been demonstrated through experimental evaluations. The results show that the approach is quite effective.